#include <stdio.h>
#include <stdlib.h>
#include <time.h>

void secure(void)
{
    int secretcode, input;
    srand(time(NULL));

    secretcode = rand();
    scanf("%d", &input);
    if(input == secretcode)
        system("/bin/sh");
}

int main(void)
{
    setvbuf(stdout, 0LL, 2, 0LL);
    setvbuf(stdin, 0LL, 1, 0LL);

    char buf[100];

    printf("There is something amazing here, do you know anything?\n");
    gets(buf);
    printf("Maybe I will tell you next time !");

    return 0;
}


#if 0

    Arch:       i386-32-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x8048000)
    Stripped:   No
    Debuginfo:  Yes


Reading symbols from ./ret2text...
------- tip of the day (disable with set show-tips off) -------
heap_config shows heap related configuration
pwndbg> start
Temporary breakpoint 1 at 0x8048651: file ret2text.c, line 18.

Temporary breakpoint 1, main () at ret2text.c:18
18	    setvbuf(stdout, 0LL, 2, 0LL);
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────
 EAX  0xf7fac088 (environ) —▸ 0xffffd04c —▸ 0xffffd25d ◂— 'SHELL=/bin/bash'
 EBX  0
 ECX  0xef498df2
 EDX  0xffffcfd4 ◂— 0
 EDI  0xf7faa000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1ead6c
 ESI  0xf7faa000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1ead6c
 EBP  0xffffcfa8 ◂— 0
 ESP  0xffffcf20 ◂— 0
 EIP  0x8048651 (main+9) ◂— mov eax, dword ptr [0x804a060]
───────────────────────────────[ DISASM / i386 / set emulate on ]───────────────────────────────
 ► 0x8048651 <main+9>     mov    eax, dword ptr [0x804a060]     EAX, [stdout@@GLIBC_2.0] => 0xf7faad20 (_IO_2_1_stdout_) ◂— 0xfbad2084
   0x8048656 <main+14>    mov    dword ptr [esp + 0xc], 0       [0xffffcf2c] => 0
   0x804865e <main+22>    mov    dword ptr [esp + 8], 2         [0xffffcf28] => 2
   0x8048666 <main+30>    mov    dword ptr [esp + 4], 0         [0xffffcf24] => 0
   0x804866e <main+38>    mov    dword ptr [esp], eax           [0xffffcf20] => 0xf7faad20 (_IO_2_1_stdout_) ◂— 0xfbad2084
   0x8048671 <main+41>    call   setvbuf@plt                 <setvbuf@plt>
 
   0x8048676 <main+46>    mov    eax, dword ptr [0x804a040]     EAX, [stdin@@GLIBC_2.0]
   0x804867b <main+51>    mov    dword ptr [esp + 0xc], 0
   0x8048683 <main+59>    mov    dword ptr [esp + 8], 1
   0x804868b <main+67>    mov    dword ptr [esp + 4], 0
   0x8048693 <main+75>    mov    dword ptr [esp], eax
───────────────────────────────────────[ SOURCE (CODE) ]────────────────────────────────────────
In file: /home/share/work/inject/ctf-challenges/pwn/linux/user-mode/stackoverflow/ret2text/bamboofox-ret2text/ret2text.c:18
   13         system("/bin/sh");
   14 }
   15 
   16 int main(void)
   17 {
 ► 18     setvbuf(stdout, 0LL, 2, 0LL);
   19     setvbuf(stdin, 0LL, 1, 0LL);
   20 
   21     char buf[100];
   22 
   23     printf("There is something amazing here, do you know anything?\n");
───────────────────────────────────────────[ STACK ]────────────────────────────────────────────
00:0000│ esp 0xffffcf20 ◂— 0
01:0004│-084 0xffffcf24 ◂— 0
02:0008│-080 0xffffcf28 ◂— 1
03:000c│-07c 0xffffcf2c —▸ 0xf7ffc7e0 (_rtld_global_ro) ◂— 0
04:0010│-078 0xffffcf30 ◂— 0
05:0014│-074 0xffffcf34 ◂— 0
06:0018│-070 0xffffcf38 —▸ 0xf7ffd000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x2bf24
07:001c│-06c 0xffffcf3c ◂— 0
─────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────
 ► 0 0x8048651 main+9
   1 0xf7dd9ed5 __libc_start_main+245
────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> c
Continuing.
There is something amazing here, do you know anything?
aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab
Maybe I will tell you next time !
Program received signal SIGSEGV, Segmentation fault.
0x62616164 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
─────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]─────────────────────
*EAX  0
 EBX  0
*ECX  0xffffffff
*EDX  0x21
 EDI  0xf7faa000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1ead6c
 ESI  0xf7faa000 (_GLOBAL_OFFSET_TABLE_) ◂— 0x1ead6c
*EBP  0x62616163 ('caab')
*ESP  0xffffcfb0 ◂— 'eaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
*EIP  0x62616164 ('daab')
───────────────────────────────[ DISASM / i386 / set emulate on ]───────────────────────────────
Invalid address 0x62616164


───────────────────────────────────────────[ STACK ]────────────────────────────────────────────
00:0000│ esp 0xffffcfb0 ◂— 'eaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
01:0004│     0xffffcfb4 ◂— 'faabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
02:0008│     0xffffcfb8 ◂— 'gaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
03:000c│     0xffffcfbc ◂— 'haabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
04:0010│     0xffffcfc0 ◂— 'iaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
05:0014│     0xffffcfc4 ◂— 'jaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
06:0018│     0xffffcfc8 ◂— 'kaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
07:001c│     0xffffcfcc ◂— 'laabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab'
─────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────
 ► 0 0x62616164
   1 0x62616165
   2 0x62616166
   3 0x62616167
   4 0x62616168
   5 0x62616169
   6 0x6261616a
   7 0x6261616b
────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 


080485fd <secure>:
 80485fd:	55                   	push   %ebp
 80485fe:	89 e5                	mov    %esp,%ebp
 8048600:	83 ec 28             	sub    $0x28,%esp
 8048603:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
 804860a:	e8 61 fe ff ff       	call   8048470 <time@plt>
 804860f:	89 04 24             	mov    %eax,(%esp)
 8048612:	e8 99 fe ff ff       	call   80484b0 <srand@plt>
 8048617:	e8 c4 fe ff ff       	call   80484e0 <rand@plt>
 804861c:	89 45 f4             	mov    %eax,-0xc(%ebp)
 804861f:	8d 45 f0             	lea    -0x10(%ebp),%eax
 8048622:	89 44 24 04          	mov    %eax,0x4(%esp)
 8048626:	c7 04 24 60 87 04 08 	movl   $0x8048760,(%esp)
 804862d:	e8 be fe ff ff       	call   80484f0 <__isoc99_scanf@plt>
 8048632:	8b 45 f0             	mov    -0x10(%ebp),%eax
 8048635:	3b 45 f4             	cmp    -0xc(%ebp),%eax
 8048638:	75 0c                	jne    8048646 <secure+0x49>
 804863a:	c7 04 24 63 87 04 08 	movl   $0x8048763,(%esp)            // 跳转此处
 8048641:	e8 4a fe ff ff       	call   8048490 <system@plt>
 8048646:	c9                   	leave  
 8048647:	c3                   	ret    

08048648 <main>:
 8048648:	55                   	push   %ebp
 8048649:	89 e5                	mov    %esp,%ebp
 804864b:	83 e4 f0             	and    $0xfffffff0,%esp
 804864e:	83 c4 80             	add    $0xffffff80,%esp
 8048651:	a1 60 a0 04 08       	mov    0x804a060,%eax
 8048656:	c7 44 24 0c 00 00 00 	movl   $0x0,0xc(%esp)
 804865d:	00 
 804865e:	c7 44 24 08 02 00 00 	movl   $0x2,0x8(%esp)
 8048665:	00 
 8048666:	c7 44 24 04 00 00 00 	movl   $0x0,0x4(%esp)
 804866d:	00 
 804866e:	89 04 24             	mov    %eax,(%esp)
 8048671:	e8 5a fe ff ff       	call   80484d0 <setvbuf@plt>
 8048676:	a1 40 a0 04 08       	mov    0x804a040,%eax
 804867b:	c7 44 24 0c 00 00 00 	movl   $0x0,0xc(%esp)
 8048682:	00 
 8048683:	c7 44 24 08 01 00 00 	movl   $0x1,0x8(%esp)
 804868a:	00 
 804868b:	c7 44 24 04 00 00 00 	movl   $0x0,0x4(%esp)
 8048692:	00 
 8048693:	89 04 24             	mov    %eax,(%esp)
 8048696:	e8 35 fe ff ff       	call   80484d0 <setvbuf@plt>
 804869b:	c7 04 24 6c 87 04 08 	movl   $0x804876c,(%esp)
 80486a2:	e8 d9 fd ff ff       	call   8048480 <puts@plt>
 80486a7:	8d 44 24 1c          	lea    0x1c(%esp),%eax
 80486ab:	89 04 24             	mov    %eax,(%esp)
 80486ae:	e8 ad fd ff ff       	call   8048460 <gets@plt>
 80486b3:	c7 04 24 a4 87 04 08 	movl   $0x80487a4,(%esp)
 80486ba:	e8 91 fd ff ff       	call   8048450 <printf@plt>
 80486bf:	b8 00 00 00 00       	mov    $0x0,%eax
 80486c4:	c9                   	leave  
 80486c5:	c3                   	ret    

#endif




